Add and require signatures with tokens

This already happens for session tokens automatically, so this just
affects password tokens.  This at least prevents the database from being
useful on its own.