Backend/API for "Due date" calendar

For #1112 (closed)

The following flow is implemented as Backend/API:

1. no user can initially retrieve their calendar
2. a user may "create" a calendar which sets a user specific token to retrieve such
3. the token is transferred in user_settings api view
4. the user may use this token to retrieve their calendar without authentification (get api_calendar_url(token: @current_user.calendar_token))
5. the user may "destroy" the current token to disable access to their calendar
6. the user may then again "create" a calendar/token etc. etc.

see tests/controllers/api/calendars_controller_test.rb for details of using the API