auth.token_factory is too complex for its own good

[termie]

it doesn't appear to really even understand what it is doing, it should be simplified to reduce bugs, operational overhead and make it understandable by future coders

[Henry Nash (henry-nash)]

It seems to me that the issue is to more cleanly implement the concept that:

- creating the token for the first time will create the token entry and enumerate the authorization agreed
- validating a token should simply enumerate the authorisation agreed at the time of authentication

[Dolph Mathews (dolph)]

Agree, but don't want to hang a bug on a refactor.