Modify `loopback.rest` to include `loopback.token`

Make `loopback.rest` self-contained, so that authentication works out of the box.

```js
var app = loopback();
app.enableAuth();
app.use(loopback.rest());
```

Note that cookie parsing middleware is not added, users have to explicitly configure that if they want to store access tokens in cookies.

Modify `loopback.token` to skip token lookup when the request already contains `accessToken` property. This is in line with other connect-based middleware like `cookieParser` or `json` and allows developers to install their custom instance of `loopback.token` middleware before `loopback.rest`:

```js
var app = loopback();
// setup models & datasources
app.enableAuth();

app.use(loopback.token({ model: MyToken }));
app.use(loopback.rest());
app.listen();
```

This patch is based on the older pull request #167. The major difference is how the AccessToken model is resolved - #167 used a new method `app.getModelByType`, this patch uses existing `loopback.getModelByType`.

/to @raymondfeng @ritch please review