changed user-list to token-get, since we don't want admin rights for the test user