Remove log of unencrypted token
Add decrypt to tokenstore
Add retrieve userprofile
Protect /private/ * /api/