API2 work
 - on login, user is asked for details and password.
 - can set and choose permissions
 - removed is_write_user_profile - it didn't make any sense, there is no actions you could do on this at the moment,
   there won't be for ages, we shouldn't be trying to plan that far into the future.
 - store used_at for request token
 - moved generating user_token into API2ApplicationUserTokenRepository, only do when actually needed (on calling /api2/user_token.json )
 - callback JS