fix token authentication
add user ownership for questions