mask token as secretstring when testing tokens

[aschmidt75]

Data retrieved from /auth/token/lookup* can include the token as id, which is plain-text. Make it a SecureString when returning the result.