8079: Prevent users from looking up other users' tokens by UUID.

8079: Prevent users from looking up other users' tokens by UUID.

Previous code was allowing any user logging in through a "trusted
client" (typically Workbench) to retrieve the secret token for any
ApiClientAuthorization whose UUID is known.  This won't be acceptable
when Container records start including those UUIDs.

Also added permission for any user to update (e.g., change expiration)
and delete their current token, even if the token wasn't assigned
through a "trusted client".