Make token_file configurable

[netomi]

Currently, whenever a QuartApp is constructed, an apptoken.txt is generated in the app directory (which is the cwd most of the time). This is also true for tests, which creates additional files for nothing and create clutter in your working directory.

This PR adds a token_file parameter, to allow more fine-grained control:

• if the parameter is not provided, it defaults to the current behavior of using an apptoken.txt in the app dir
• if None is provided, no secret is read or stored from file
• You can provide an alternate name or absolute path to use a different token_file

[netomi]

Additionally, I cleaned up existing test cases to not generate a token_file to avoid creating apptoken.txt files when running the tests.