Token auth feature flag

Allow token based authentication to be disabled with:

```ruby
config.disable_token_auth = true
```

When disabled the following will happen:
- Token auth hidden from login page
- attempts to create tokens via POST to TokensController will redirect to login page with flash message
- attempts to login using a token url will redirect to login page with flash message
- email notifications will not contain token links