Token-based authentication

This PR introduces authentication on top of the User model.
Because POST arguments are format-agnostic, and in the future the format of the response could change, based on the accepts header, for example.