add an Authenticate and InvalidateToken effect intents

and use them instead of some custom FuncIntents in the http code, making the tests a lot nicer.