[api] allow the use of tokens at the /user/x/sensor endpoint