Support a long-duration (30 days) token request

This is the code to let the user-api support a token request for a 30-day token which can support mobile use. All user tokens of longer than 2 hours are considered nonrenewable (the renew call simply returns the same token). Server tokens are always renewable.

It has the side effect of making tokens longer. 

This PR will be followed by one to move the token data into a database and to use short opaque token hashes instead.

@cheddar if you can take a peek, i'd appreciate it.