Store token rather than credentials

[SchrodingersGat]

Currently the user credentials are stored (securely), rather than the token.

This means that revoking the token (from the server) does not prevent the app from logging back in.

Instead, we should request and store the token, and if the auth fails, the user has to re-enter their username/password.

[SchrodingersGat]

Token should also be scoped to the app - don't allow use of generic or other tokens