Retrieve token from req.query + Token key is configurable + Basic unit tests

Token key is configurable, so we can choose the key name to retrieve in req.body or req.query.
Token can be retrieved from req.query if provided, as we need for most of GET routes.
Basic unit tests have been written for token-session (there were only old test for session by cookie).