JWT Tokens

I've barely started and it's mostly proof-of-concept but I wanna get feedback on this early.  It's huge, it's ugly, and it overrides a lot of Devise.  It got really big really fast so I'll probably move it to a module mixed into the ApplicationController.

Oh and, in case it's not clear, a lot of the code is just to make sure the old auth_token works too, and can be removed after migration.

All that being said, it works, and potentially solves Nuck's Ol' Bitchfest #247, including the Discourse integration (without network stuff!) and also enables us to grant OAuth tokens which can access the Internal APIs (because Tenpenchii especially relies on those) once we add that

TODO:
 * [x] Tests
 * [x] Revocation
 * [x] POSTing tokens instead of using cookies
This is a pretty big increase in the API surface area, which is especially important here since most other controllers inherit from ApplicationController.

I think the Discourse approach is a good one, see:

* https://github.com/discourse/discourse/blob/master/lib/current_user.rb
* https://github.com/discourse/discourse/blob/master/lib/auth/default_current_user_provider.rb