auth: generalize token functions

BREAK ALL THE THINGS. This is part of a huge refactoring. Handlers
aren't going to receive users anymore. Instead, they will receive token
instances.
auth: added User method to Token type

This method will return the user instance matching the current token.