Token-based authentication

This PR introduces authentication on top of the User model.
Good point. I'll make it more explicit.