Add POST /tokens — Token creation

No it is not the `token`, it is the `tokenHmacId`