remove api key, rename project id => token
support a way for users to manage their own threads