Remove token strategy from user login

The login API should not accept tokens as a valid form of user
authentication. Users could infinitely extend their login session by
exchanging old tokens for new ones without ever having to present their
full credentials.