retrieve user profile by api, requiring auth token