Token-based authentication

This PR introduces authentication on top of the User model.
Why don't you use `JSON` for sending authentication data? If you return `JSON`, you should also take `JSON` as inputs to the calls. Either that, or query strings.