remove settings as nested route and changed user settings lookup to be based on auth_token