require user token + api token