Token substitution

re: #78

Automatically substitutes API_TOKEN for logged in people.