Allow /devices.json with a valid access_token for user_id