Consider whether to teach token auth in node unit

[jrhorn424]

If we use token auth, we can drop session, and we can use curl to test api interactions.

If we teach session, we get the potential to build in oauth. If so, we should probably create and distribute curl commands with cookies.

[gaand]

I wondered about doing the inverse, using cookie auth in rails-api.
We should definitely pick one and stick with it. But probably should have a discussion about pros/cons.

[jrhorn424]

The thing that's sticking out to me right now is whether we should continue to use curl to test routes if we use cookies.

[gaand]

I take it back. I'll switch the passport lesson to use token auth for the next cohort. They mix it up in the baseline, but token auth definitely comes up.