Make `loopback.rest` self-contained

The first commit implements `app.getModelByType`, which is a twin of `loopback.geModelByType`, except it considers only models added via `app.model`.

The second commit amends `loopback.token` and `loopback.rest` middleware to allow `loopback.rest` to add access token lookup to all requests when the app has authentication enabled.

Once this patch is accepted, there will be two main ways of setting up a LB app:

```js
/** 1. REST server only **/
var app = loopback();
// optionally use favicon, logger, cookieParser
app.use(loopback.rest());
app.listen();

/** 2. Web app with REST API **/
var app = loopback();
app.use(loopback.favicon());
app.use(loopback.logger('dev'));
// optionally use cookieParser
app.use(loopback.bodyParser());
app.use('/api', loopback.rest());
app.use(app.router);
app.use(loopback.static(__dirname + '/public'));
app.use(loopback.urlNotFound());
app.use(loopback.errorHandler());
app.listen();
```

Although `loopback.rest` internally calls `loopback.token` middleware, it's possible to install a custom `loopback.token` instance. This works because `loopback.token` does not override the token already present in the request.

```js
var app = loopback();
app.use(loopback.token({ model: MyToken }));
app.use(loopback.rest());
app.listen();
```

/to @ritch @raymondfeng please review. This patch is one of the steps on the path towards a better & smaller `app.js` template in loopback-workspace.