I find it is wrong to display the full token_auth in the users listing.
Here is a proposal to make users listing more "safe" to preying eyes. - By default display only first characters eg. f4373c5.... - On click on the cell, display the full token_auth - Once expanded, if clicked again, it re-toggles back into truncated. - when it appears truncated, display mouse as pointer to show its clickable, and underline on hover
Related: New config setting to prevent Super Users from seeing other users' token_auth #6346
Pull request for this: #6394