use install generator for both migrations and initializer
set default token lifespan to 2 weeks, make configurable
add expiry to auth header