Token-based authentication

This PR introduces authentication on top of the User model.
Typo: Once *it* is no longer valid