Allow authorization read, and delete/retrieve by both token and id