support a 'condition' callable for root widgets
add a 'can' method to actions
add a root widget for token auth

This only appears for users who have some permission to edit tokens.
Fixes #62.