Added login and verify token funcs, moved authentication to sub package

Login() will return a token that the client is to use to interact
with the API. If both a key and token are given, the key is checked
first. Both must be valid for the call to continue. Theoretically
only one will be sent, but who knows.

The authentication funcs have been separated to the lib/auth package.
Eventually the lib package may have some helper functions but anything
specialized, like authentication, will most likely go in their own
sub package.