Add sessionToken to user for API authentication

After a user is created, a sessionKey is randomly generated and is used
to create a sessionToken. The JWT is then passed in via
an Authentication header, like so:

Authorization: Bearer <sessionToken>