Token resource creation

These are the steps for being able to create a token via the API (which can then be used for authentication). Steps:

- Feature/Scenario for creating tokens (authing with HTTP Basic)
- create TokenController and endpoint
- endpoint to create the token
- Bad Password Scenario
- use the actual security system
- centralize json_decode stuff
- add validation to require a note

Or better as it returns a `ParameterBag`: `getRequestParams()`?