Reset API credential secret

Generates a new secret for the credential; the existing secret stops
working immediately. The plaintext secret is returned only once — store
it securely right away. When called from the dashboard (not via an API
credential) this is a sensitive action and requires a fresh security
code/token via the X-Security-* headers. Returns 404 if the credential
does not exist or was deleted, and 409 if it is currently disabled (only
active credentials can reset their secret).