Token resource creation

These are the steps for being able to create a token via the API (which can then be used for authentication). Steps:

- Feature/Scenario for creating tokens (authing with HTTP Basic)
- create TokenController and endpoint
- endpoint to create the token
- Bad Password Scenario
- use the actual security system
- centralize json_decode stuff
- add validation to require a note

What does that mean? I think we don't get "json body", but rather we "extract data from the request", especially given the line that has been removed. What about `getRequestBody()`?