[api] fix crash when operating on not existing token
[webui] increase coverage by removing functions
[api] update gemfile versions
[api] allow nobody to query everything he's not forbidden to do
[webui] test 'download logfile'