Provide a simpler SPI for session token storage

The TokenDAO abstraction requires a search method which isn't ideal for some possible implementations. Pull the other methods up into a new interface and, where possible, use it.