added api token authorization to users controller