Hide access token (or only allow them to be copied when created)

[arteymix]

[arteymix]

For access token, we'll be adding a secret in #389 for the 1.6.0 release. For now, all we need is a mechanism for safely revealing the token.

The hidden attribute could be useful.