API upload associates file to user token belongs to if token is passed as GET parameter