Web services secured by token