Refactor tokens to use permission decorator
Add user resources