updated token string attribute name
issueing a new token must include saving the user, for convenience
corrected status code annotation
user integration tests need valid users since issueToken saves the instance
added /auth/token endpoint to authenticate and generate new user tokens