fixed HTTP API, use the user's token