Token resource creation

These are the steps for being able to create a token via the API (which can then be used for authentication). Steps:

- Feature/Scenario for creating tokens (authing with HTTP Basic)
- create TokenController and endpoint
- endpoint to create the token
- Bad Password Scenario
- use the actual security system
- centralize json_decode stuff
- add validation to require a note

Yes, you're totally right - I've chosen the long, but descriptive name `decodeRequestBodyIntoParameters`. Maybe not perfect (because it's loooon), but definitely better (especially since, as you said, it returns a ParameterBag).