Implement API token auth, not using validity yet