Doc updates, Token auth scheme, Test coverage updates

# What's New?

 * We have CORS support
 * We have a token auth scheme (See `api_docs.md` for usage examples)
 * We have a way of creating tokens (but not for deletion yet)

# What's Next?

 * Token deletion
 * Email consent checkbox

I need to config hound to ignore this for heredocs.