8853 Prevent the retrieval of API tokens after creation

[arthanson]

Fixes: #8853

Prevents retrieval of API tokens after creation. @jeremystretch the "Add another" makes things a bit different to put in, here is a first stab at system (but I'm not a UX person). Presents a page after creation where you can see the key with a note to copy it down. Edit page does not show the key, could have it present the key as asterisks if that would be better.

Right now the key display page could be used if they use the URL with the object id, so if they bookmark that page they could go back to it. Do we want security around it to prevent that, so it can only be pulled up as a one-time thing? Right now the security is that it can't be navigate to without going through create. I originally planned on just passing the key to the page which would make it secure, but the rest of the page requires the object.