Doc updates, Token auth scheme, Test coverage updates

# What's New?

 * We have CORS support
 * We have a token auth scheme (See `api_docs.md` for usage examples)
 * We have a way of creating tokens (but not for deletion yet)

# What's Next?

 * Token deletion
 * Email consent checkbox

That's not true in this case- I needed the variable to go out of scope so I could test that plaintext tokens are not being persisted.