refactor(auth): send login token through apiFetch

All authenticated calls now use apiFetch, and only utils/auth.js
touches the stored token. The cookie login can then change these two
files instead of every page.

src/utils/auth.js

@@ -1,5 +1,11 @@
 const TOKEN_KEY = 'tbp_jwt';
 
+export const getToken = () => localStorage.getItem(TOKEN_KEY);
+
+export const setToken = (token) => localStorage.setItem(TOKEN_KEY, token);
+
+export const clearToken = () => localStorage.removeItem(TOKEN_KEY);
+
 /**
  * Only checks `exp`. The signature is checked by the backends.
  */
@@ -17,9 +23,9 @@ export function isTokenValid(token, nowMs = Date.now()) {
  * Returns the stored token, or null. Removes an expired token.
  */
 export function getValidToken() {
-    const token = localStorage.getItem(TOKEN_KEY);
+    const token = getToken();
     if (token && !isTokenValid(token)) {
-        localStorage.removeItem(TOKEN_KEY);
+        clearToken();
         return null;
     }
     return token;