use more elegant scheme for Token-based Auth

1. base `TokenView` and `TokenAuth` on `TOKEN_USER` settings
2. subclass `TokenUser` to customize user-related operations
3. update demo and tests for token
support logout by invalidating tokens

1. invalidate a token by: DELETE /tokens/<token>
2. update demo and tests for `logout` logic