must append user token after the url