Hide access tokens if user is not the project owner.

This prevents sneaky read-only users from sniffing out the read-write
link via the browser console.

services/web/app/coffee/Features/Editor/EditorHttpController.coffee

@@ -22,6 +22,9 @@ module.exports = EditorHttpController =
 		Metrics.inc "editor.join-project"
 		EditorHttpController._buildJoinProjectView req, project_id, user_id, (error, project, privilegeLevel) ->
 			return next(error) if error?
+			# Hide access tokens if this is not the project owner
+			if privilegeLevel != 'owner' && project.tokens?
+				project.tokens = {readOnly: '', readAndWrite: ''}
 			res.json {
 				project: project
 				privilegeLevel: privilegeLevel