Don't send API tokens to everyone

Only respond with an API token on the /me route