support Token-based authentication

1. use `signer` (based on library `itsdangerous`) to dump/load tokens
2. generate tokens via `TokenView`, validate tokens via `TokenAuth`
3. add `SECRET_KEY` and `TOKEN_EXPIRES` settings for token
add demo `token-login` and test "test_token.py"