Use app_token for app authentication
Exclude oauth_token from Users#show response