Every user automatically gets an API token via a post-save signal on the User model. We just have not yet shown it to the user.

• Display User's DRF API Token in their Profile card #1468
• Allow the User to reset their DRF API Token in the UserUpdateView(UpdateView) #1473

I'm separating out this item as it will be addressed independently by #1459

• Use the API Token, where we otherwise might use a password (IYKWIM)