Add support for token management

[toppercodes]

No description provided.

[lukasmalkmus]

Left some comments, most of them rather trivial.

One bigger change I wanna discuss is the package level capabilities API.

My feeling is that the capabilities should be typed (permissions?). E.g.:

cap := map[string]DatasetCapabilities{
	"dataset": {
		Ingest: []string{"create"},
		Query:  []string{"read"},
	},
}

becomes:

cap := map[string]DatasetCapabilities{
	"dataset": {
		Ingest: []Permission{PermissionCreate},
		Query:  []Permission{PermissionRead},
	},
}

Maybe Permission -> APIPermission but you get the idea. I think a prefix for the constants is a must because their names are to generic (essentially just CRUD verbs).

For an implementation, see UserRole in users.go.

[lukasmalkmus]

Three mini fixes. But please do add the unit tests for Action, tho.