Token verifier

Also written: verify_token, AccessToken

Server code with a `verify_token` method that checks an access token and returns an `AccessToken`, or None to refuse it.