Refactor Token into a model, add tests
Move the auth helpers out into a separate module
Add issuance timestamp to tokens