update schemas

- User's "code" is now "token"
user's notification system stuff
Plugins API improvements

added `Plugin.<PluginName>.settingsValidate` event, plugins can now
easily validate each input in their settings form