ApiResource: support token auth