global app token required
do not return contacts of any user unless requested