make token-id from user-pk

1. use user-pk instead of token-value (which is ugly in URL) as token-id
2. login by: POST /tokens, logout by: DELETE /tokens/<id>
3. make parameters and return values of methods in `TokenUser` more
explicit: replace `key` with (`pk`, `secret`)