Implement issuer tokens [closes #9]

Issuer tokens allow third parties to issue badges directly to a backpack, but do nothing else – they only get access to the `POST /user/:id/badges` route.

This implements a new model, `IssuerTokens` to hold those tokens, as well as a new binary `bin/generate-tokens`, so key/token sets can be generated via the command line:

![generate-tokens](https://i.cloudup.com/Mvw3ZeuaUS.png)

This key/token pair can be given to an issuer who would use it to generate their `Authorization` header when sending in a request.

would be nice to pull this list out and make it more obvious that these are the endpoints that are protected. Maybe a auth module that defines user types and permissions?