Implementing tokenbased security for public/private API