Fix for Python 3.6

This avoids duplicate calls to Check.get_grace_start() in several places.

when 10 or less remaining.

Use mark_safe to use html in users list admin

When setting api key, decode the generated key from bytes to str to avoid b'...' bit

urlsafe_b64encode return a byte, which will result in an api key saved with something like b'apikey'
I did not tested it but urlsafe_b64decode looks like doing the job also.