Implement app.getModelByType()

A method similar to loopback.getModelByType(), but checking
only the models added to the app via `app.model`.

Fix a bug in loopback() which caused all `app` instances to share
the `app.models` registry.
Modify `loopback.rest` to include `loopback.token`

Make `loopback.rest` self-contained, so that authentication works
out of the box.

    var app = loopback();
    app.enableAuth();
    app.use(loopback.rest());

Note that cookie parsing middleware is not added, users have to
explicitly configure that if they want to store access tokens
in cookies.

Modify `loopback.token` to skip token lookup when the request already
contains `accessToken` property. This is in line with other
connect-based middleware like `cookieParser` or `json`.