Refactor extract SignInHandler, inject dependency

Add SignInHandler private specs (there is no public interface for now)

The dependency to the Devise secure comparison method is now
encapsulated in the `ActsAsTokenAuthenticationHandler#sign_in_handler`
method.

If necessary, the `#perform_sign_in!` specs could be written using
a DummySignInHandler instead of the Devise-dependent SignInHandler.