tokens: implement new token command

Implement a command to create a new access token on your account.
Requires your username and password -- like all access token commands --
and optionally takes the "username" for the token (shown as the "client"
when listing tokens).

The "password" for access tokens appears to be unused currently, so the
new code handles this the same way as the login API call, using the
string "client_secret_here" as a placeholder.
tokens: allow many tokens to be revoked at once

Rework how the token revoke command handles arguments so you can revoke
any number of tokens with a single invocation of the command (and only
have to pass in your credentials once!)
api-client: make login call use createAccessToken

Having implemented createAccessToken separately, refactor the login API
call to just use that API call and then do its own work storing the
returned access token.