Add option to use tokens for API

[dssecret]

So that API keys aren't leaked on the HTML and to partially minimize CSRF attacks. Could likely use same functions as the User Settings endpoint but with the token in cookies or somewhere else instead of query param.

[dssecret]

Basic testing complete. Closing!