api.pl, api.js: now token should be passed only as s CGI parameter