do not use https in development
add generate api access token action to the users controller

so that the user can regenerate the token