NewBuilder creates a new APIToken JWT builder It supports expiration and revocation Currently we use a simple hmac encryption method meant to be continuously rotated TODO: additional/alternative encryption method, i.e DSE asymmetric, see CAS robot account for reference.