Refactor auth_token cache

There are very different paths for when we are encrypting tokens before
saving them to memcache. Extract the encrypted strategy out to its own
class to see the similarities.

Change-Id: I5bf5dae3143f15a840a580a2e01ba67c50911276