Don't expire tokens by default

[lserman]

We should provide an API for cycling tokens instead of expiring them after 14 days.

[fbcouch]

It would be nice to have something like google where you have a token for each session and you can expire them individually

[lserman]

What's the value in that, and how would that work?

[RileyMills]

Value is you can track individual device sessions, so you know what was done by which device. As for implementing it, users could have_many session tokens, instead of just the one.

[lserman]

That would be sweet actually, then we can manage authentication tokens within an engine model instead of shimming authentication_token onto the existing user model. Let's do that.