Token authentication for Chef Server

Ping @smith @seth @mmzyk @danielsdeleo @lamont-granquist.

Hot off the presses, have at it!
Does creating a token require an already valid token or otherwise authenticated request? I was expecting only to exchange username and password for a valid token.