JZ: Fix #16, #17 and auth by api_token "oversight"