Tokens are a queer beast. We should look into their APIs and make sure they are not easy to abuse.

Thoughts:

1. Token.unresolved instead of cdk.unresolve
2. Hide resolve so that it doesn't appear in public API
3. Factory methods for specific use cases instead of new Token. For example Token.lazy(() => )
4. Tokens are conceptually coupled to synthesis and now also must be anchored by a construct scope ("lazy" means - resolve during synthesis), maybe we can simply move all token facilities to Construct.node