Add a 3-minute access token to url if requested
Add a 3-minute access token to url if requested

This is appended to the urls of external activities, in the form
`token=<access-token>`.

The 3-minutes could be settable in the future, but at the moment it
should be plenty of time to open the activity, and have the activity
call back with the token for a longer-lived JWT token.

concord-consortium/rigse,concord-consortium/rigse,concord-consortium/rigse,concord-consortium/rigse,concord-consortium/rigse,concord-consortium/rigse