feat(token): add first command: token

Besides the token command, this includes much of the underlying
design that all commands will build off of.
While I was writing this, browserid-crypto only used the new formats, and those didn't work with the auth-server.