users: added more secure way for fetching authentication tokens.

- we don't expose ALL on single page
- request needs a validation before viewing of each token
- will later add 2nd layer of auth.

rhodecode/apps/admin/tests/test_admin_users.py

@@ -143,7 +143,7 @@ class TestAdminUsersView(TestController):
         response = self.app.get(
             route_path('edit_user_auth_tokens', user_id=user_id))
         for token in auth_tokens:
-            response.mustcontain(token)
+            response.mustcontain(token[:4])
             response.mustcontain('never')
 
     @pytest.mark.parametrize("desc, lifetime", [
@@ -165,7 +165,7 @@ class TestAdminUsersView(TestController):
         response = response.follow()
         user = User.get(user_id)
         for auth_token in user.auth_tokens:
-            response.mustcontain(auth_token)
+            response.mustcontain(auth_token[:4])
 
     def test_delete_auth_token(self, user_util):
         self.log_user()