token authentication (via user_token parameter)