Tidy up setting secure token on API requests

* Moved with_secure_token() calls to an around filter in ApplicationController