def METHOD_NAME(username, id):
	user = User.query.filter_by(username=username).first()
	if user is None:
		abort(404)
	if not user.check_perm(current_user, Permission.CREATE_TOKEN):
		abort(403)
	token = APIToken.query.get(id)
	if token is None:
		abort(404)
	elif token.owner != user:
		abort(403)
	token.access_token = random_string(32)
	db.session.commit() # save
	# Store token so it can be shown in the edit page
	session["token_" + str(token.id)] = token.access_token
	return redirect(url_for("api.create_edit_token", username=username, id=token.id))