Closes #2240: Return api-token on user login

[mapkyca]

Here's what I fixed or added:

This patch modifies the session/login endpoint slightly so that it will, when hit by a non-default tempate (e.g. API), will generate and return the logged in user's API token.

Here's why I did it:

API onboarding is hard, and asking individual users to generate OAuth2 applications or enter a long api token string is not feasible.

I believe the solution is to generate and retrieve the api-token on session/login, after the login process has been completed successfully. I believe this is not a security hole as the user will have passed security checks at this point, and this is no different to hitting the api token endpoint.

Well, that's not actually quite true (see #831), tokens are stored clear in the database and so if that is compromised is will cause problems. Scope for this is limited with this patch as token is only generated for people who hit the login page as an API user. Long term or in a hosted environment, these tokens should be stored in a secure key store.

Checklist:

• This pull request addresses a single issue
• If this code includes interface changes, I've included screenshots in this Pull Request thread
• I've adhered to Known's style guide (these codesniffer rules might help!)
• My git branch is named in a descriptive way - i.e., yourname-summary-of-issue
• I've tested my code in-browser
• My code contains descriptive comments
• I've added tests where applicable, and...
• I can run the unit tests successfully.