edf5495fe5
1. 'auth_method' in config, where users can select between 'password' and 'token'. 2. create index for token, avoid iterating the entire user section when validating tokens. 3. only generate token for a user when there's no token for him in the db, avoid tokens fill the db.