Add an API token strategy.

[zachdaniel]

API tokens are essentially "if you have this value then we can authenticate you", so it should be relatively simple to add an api token strategy. No need for a JWT to be involved, so it would have to make the jwt in the token resource optional, or be its own resource. I think perhaps ApiToken being its own resource wouldn't be too bad.