Settings screen for adjusting tokens now abides by permissions on the client side
allowd for improoved stacking of settings panes
added .loginWithKey, so login is possible with just a key now, too.
persistant login sessions

They are managed in the client - I don't really think this is a security problem though, because the auth key is sent with all requests anyway.