Don't return actual token to JS for trello

app/app/components/section/trello/type-editor.js

@@ -59,7 +59,7 @@ export default Ember.Component.extend(SectionMixin, NotifierMixin, TooltipMixin,
 		this.get('sectionService').fetch(page, "config", {})
 			.then(function (s) {
 				self.set('appKey', s.appKey);
-				self.set('config.token', s.token); // the user's own token, drawn from the DB
+				self.set('config.token', s.token); // the user's own token has been stored in the DB
 
 				// On auth callback capture user token
 				let hashToken = window.location.hash;

documize/section/trello/trello.go

@@ -127,7 +127,9 @@ func (*Provider) Command(ctx *provider.Context, w http.ResponseWriter, r *http.R
 			Token  string `json:"token"`
 		}
 		ret.AppKey = config.AppKey
-		ret.Token = config.Token
+		if config.Token != "" {
+			ret.Token = provider.SecretReplacement
+		}
 		provider.WriteJSON(w, ret)
 		return