Add POST /tokens — Token creation

we probably should abstract this thing in a `get_hawk_session_token` function.