Improve security and flexibility of token auth.

 * Refactor `auth_token` on User to its own model.
 * Add auto-expire behavior to Tokens.
 * Add auto-renew behavior to Tokens
 * Differentiate between invalid-credentials and token-expired.
 * Update specs to use the new authentication method.
 * Remove irrelevant concerns, specs, and migrations.