Display API token in user profile (only to the given user)

For #24