Improve security and flexibility of token auth.

 * Refactor `auth_token` on User to its own model.
 * Add auto-expire behavior to Tokens.
 * Add auto-renew behavior to Tokens
 * Differentiate between invalid-credentials and token-expired.
 * Update specs to use the new authentication method.
 * Remove irrelevant concerns, specs, and migrations.
Add policy for Token resource.
Add API for Token resource.
Merge branch '8-token-api'