Generate tokens with JWT, and migrate old-tokened requests
Refactor Token into a model, add tests
Move the auth helpers out into a separate module
Add issuance timestamp to tokens
Add a test for User#update_ip!