implementation of APP token (app+user) authentication, rather than just usertoken (user)
close #13