Classify API token as password

While API token could grant access on the same level as username/password we should classify it like password. So it will be hidden in the form.