Fix authentication for creating tokens
Use user, where it can be both admin and user