Split User.for_api_token into separate lookup and create methods
Use Warden for authentication
Don't use AR API outside of AR classes