minor: refactor token auth a bit
rename authorize to require_login

authorize_admin -> require_admin

also add require_token which will ensure token has been used for auth.
minor: more robust destruction of records in tests
refactor tests to ease the testing of token only auth
split up and expand account integration test
require token when updating user via API
require token when logging out via API
require token in messages controller