Remove api_token
Scope routes by user