allow users to generate API tokens #1098