Refactoring token handling

I am using two session tokens, one for editing and one for view. This fixes an issue that everybody can alter and view data using the object id. Now each person must know the token that can by reset at any time.