JWT Tokens

I've barely started and it's mostly proof-of-concept but I wanna get feedback on this early.  It's huge, it's ugly, and it overrides a lot of Devise.  It got really big really fast so I'll probably move it to a module mixed into the ApplicationController.

Oh and, in case it's not clear, a lot of the code is just to make sure the old auth_token works too, and can be removed after migration.

All that being said, it works, and potentially solves Nuck's Ol' Bitchfest #247, including the Discourse integration (without network stuff!) and also enables us to grant OAuth tokens which can access the Internal APIs (because Tenpenchii especially relies on those) once we add that

TODO:
 * [x] Tests
 * [x] Revocation
 * [x] POSTing tokens instead of using cookies
 * [x] Add "iss" (issued-at) to payload for time-based revocation
 * [x] Refactor into mixin
 * [x] Rebase
 * [x] Add JWT_SECRET to Ansible
 * [x] Add Discourse integration
 * [x] Add the new tokens to API login
It doesn't need to be public, but marking it private doesn't do anything because of the way controllers work in Rails.

It can't really be moved elsewhere because it's dependent on cookies and params