First pass of api token authentication