Token-based authentication

This PR introduces authentication on top of the User model.
I prefer the form: ``salt = salt or self.salt or bcrypt.gensalt()``