add api_controller authorize_token! function