User updated with proper access token handling.

An access token is now created upon successful User login and treated
as session credentials. This token is registered with the REST adapter
and set in the HTTP header for all subsequent REST calls.  Logout will
clear this token.