Better token auth

[magnusvk]

We currently have a separate token auth solution at Bonobos that is considerably better than the default in Spree now:

• not susceptible to timing attacks
• stores hashed tokens, rather than cleartext tokens in the database
• supports multiple tokens per user
• supports token expiration

I've started work on breaking this out into a devise module, but there's more work to do there. I think we should make this a part of solidus_auth_devise by default and remove the current api_key from spree_users.

[gmacdougall]

Closing due to being stale.

[magnusvk]

👋 blast from the past here. 🙃

[skycocker]

@magnusvk and others as well: in case you were still interested, I created a fork of solidus that supports devise_token_auth: https://github.com/skycocker/solidus_devise_token_auth