Token-based authentication

This PR introduces authentication on top of the User model.
Regarding query string... Just seemed natural to `POST` them because I'm not just `GET`ting a resource state, I'm triggering the generation of a token.