Use user token if possible when making ajax calls

Currently in our ajax method we setHeader authorization to the app token when we should be using the user token.