API adjustments

[kris-lab]

/admin user should contain internal token in server response. This token should be saved in admin database.

[mariansollmann]

agree. I will add this

[mariansollmann]

should this also be in the "list" or only in create and get?

[kris-lab]

it would be safer if it is only on create! but would also make sense if you like e.g. be other user without login as that user (for admin)