Token store is not specific to Rack
Remove non-throwing authorize
Match client and session token methods
Logout rescues API errors only
Don't trust device when not logged in