username password swapped out for token
token added to all requests to api server