ensure_runners_token on read instead of write

1. we don't want to migrate all existing groups
2. we generate the token when showing the runners page, as this is the
   first time that the token will be used.