Move token data to token.php

Since token requires db.php, I don't require it again. The token is no longer included in a GET request to process.php, use sessions instead.