Expose API tokens to LMS users

Jon [noted in Slack](https://hypothes-is.slack.com/archives/C4K6M7P5E/p1547142039093700) that it is possible to use facet, and other hlib-based tools (e.g. StudentReview, ContributorFocus), as an LMS user. The user needs to grab an API token using a debugging tool, and it's unclear how long that token will work.

I think it would be good to open up uses of our API that first-party users currently have access to.

I'm not sure where/how it would make sense to expose API tokens (we currently do this for first-party users through activity pages.