use more elegant scheme for Token-based Auth

1. base `TokenView` and `TokenAuth` on `TOKEN_USER` settings
2. subclass `TokenUser` to customize user-related operations