Actual sessions

[nic-hartley]

Goal

Instead of using the username as the token, we should implement actual auth tokens.

Description

To auth, you currently just use the username to auth as for your Authentication Bearer token value. We should add something that maps (randomly generated) tokens to the actual users.

This will probably be a database table, but as long as you can't generate a token without sending a request to the backend with the correct password, the actual implementation doesn't matter much.

Additional notes

This can be done even before #18 - we only need to map the session tokens to a user somehow, and that can be changed once we have the actual users table for integration.