Ability to change API token

[turicas]

It's a security risk having only one unchangeable token (specially if we don't provide SSL). So, I think the user should be able to change her token (a POST to /user/api-token will do the job).