Add app_token to requests