Fix a couple trivial issues with the API token form.

With the new(er) validation code, creating a new token was failing,
since the default was 'null' instead of {}. This caused a failure in
validation that didn't previously exist.

Also, the My Account CSS bundle was named with a .js extension,
preventing it from loading. This fixes the name.