Implement Session persistence for staff members

[wqyeo]

Staff members, upon login, shall be given a session token for login persistence.

1. Client-side staff logins (Assume correct credentials)
2. API create a new session token, sends to client
3. Client receives and store session token.
4. Future API calls and action should require session token to perform.

Thing to consider

• Expiration for token; Allow staff to select if login persists or not.
• A token shall not be used by a different client. (Security; Store the client device information, and require client device to provide their own information alongside with token when doing actions. If the device information and token doesn't match, request for re-authentication again)

[wqyeo]

Done with Aphasia-Chatter/backend-stack#1