Support a persona request parameter for tokens

Take a step toward multiple authentication support by allowing the
token view to select from multiple personas according to a request
parameter, defaulting to the first one.
Fetch api tokens in a separate request

Instead of sending a token with the application view (which is really
more of a session state view), fetch it separately using the tokenUrl
option of the Auth plugin. Account for the case where known personas
could change in the future without invalidating the current persona
and reset the Auth plugin whenever the persona in use changes. Use the
persona parameter to the token endpoint to get the appropriate token.
Get rid of overly verbose helpers on AppController
Avoid a race condition with session-based auth

Don't send a new search request until the logout request has returned.