@Ryan Hellyer - If we implement a token system, the question then becomes, how do we handle this? We could create our own system, but it seems like a waste to reinvent the wheel, so we'd probably go with an existing system, such as OAuth. I know from experience that OAuth is not exactly trivial to implement (althought OAuth 2 is better), so it would be a fairly heavyweight feature to include in core.

Not saying it won't happen, but I suspect it'll stay in plugin territory for now. That might be reconsidered based on what we as a team decide though.