Auth Token changes (#29, #30, #14)

 * !WARNING! non-backward-compatible schema changes
 * theoretically allows tokens to live forever (untested)
 * uses PHP's password_hash() and password_verify() instead of complex hashing
 * basic testing for now