Story/cite 217 - It should be possible to create personal access tokens

[PradnyaC11]

Guidelines for Pull Requests

If you haven't yet read our code review guidelines, please do so, You can find them here.

Please confirm the following by adding an x for each item (turn [ ] into [x]).

• I have removed all code style changes that are not necessary (e.g. changing blanks across the whole file that don’t need to be changed, adding empty lines in parts other than your own code)
• I am not making any changes to files that don’t have any effect (e.g. imports added that don’t need to be added)
• I do not have any sysout statements in my code or commented out code that isn’t needed anymore
• I am not reformatting any files in the wrong format or without cause.
• I am not changing file encoding or line endings to something else than UTF-8, LF
• My pull request does not show an insane amount of files being changed although my ticket only requires a few files being changed
• I have added Javadoc/documentation where appropriate
• I have added test cases where appropriate
• I have explained any part of my code/implementation decisions that is not be self-explanatory

Please provide a brief description of your ticket

It should be possible to create personal access tokens

... Put ticket description here and add link to ticket ...
A user should be able to create personal access tokens that they can use to use the Citesphere API. The tokens should only allow access to their own data (like any token retrieved via the authorization code flow). After being generated, a token should be visible once, after that the user can only regenerate a token if they loose it. It should be possible to delete tokens.

https://diging.atlassian.net/browse/CITE-217

Are there any other pull requests that this one depends on?

diging/citesphere-model#58

Anything else the reviewer needs to know?

... describe here ...

[diging-jenkins]

Can one of the admins verify this patch?

[jdamerow]

indentation

[jdamerow]

all of the code related to personal access tokens should be in its own manager class not mixed in with the oauth clients. Also, I think we want only one OAuthClient (for the user) and then create multiple access token for the client, rather than multiple oauthclients. Or is there a reason to have one client per token? and then finally, I think I would consider creating a subclass for oauthclient for personal access tokens, rather than a boolean flag. but is that flag really needed? it looks like it's only used once, and with a separate manager class, it might not be necessary?