Moved CorsFilter initialization to SecurityWebAppInitializer.
Added "OPTIONS" and "POST" to allowed CORS methods. Added custom auth
header to allowed headers.
Added authToken to User and a query to get a user by authToken.
Added authentification filter, handler and tokenservice.