Auth token is not reset in the app when signOut

# In this bug fix, we 
1. always read localStorage to set the xhr header.
2. store the auth token only in localStorage.
3. set the auth token to null when sign out.

# Questions:
1. We are using functions such as signIn, signOut ... Should we use computed property and get method?
2. Currently we assume auth token will never change, do we need to deal with that? If we do, we need to rewrite isSignedIn to fire a request to server.