Refactor API auth and extend token.

Move auth-token route into /api and add extend-auth-token route.