Require a serverToken  on the private collection

Also, upgrade to newer versions of hakken and user-api-client