fix #72 - add tokens for users for API auth