As of loopback v1.8.4 and 2.0.0-beta3, `loopback.token()` is automatically included by `loopback.rest()` when auth is enabled (see strongloop/loopback#263).