Opened token api access to all users; restricted to only show currently-logged-in-users tokens