512 api tokens

Allow people to use a generated token for API auth. Currently the token has the same permissions as the user it was generated against. Includes a basic interface for generating and removing API tokens.

Fixes #512