Apply API token checking to all calls