Token authentication for Chef Server

Ping @smith @seth @mmzyk @danielsdeleo @lamont-granquist.

Hot off the presses, have at it!
Is the 16 character specification something to fit an existing standard? A minimum to achieve security based on randomly generated tokens or of some other significance?