user token authentication to support api