Token authentication for Chef Server

Ping @smith @seth @mmzyk @danielsdeleo @lamont-granquist.

Hot off the presses, have at it!
Isn't this contrary to good security practice?