Document user authentication and associated new api methods

@loopj We started calling this `auth token` to help distinguish it from the `API key` used for notifications.