improve access checks of api
add access restriction on token deletion