api: plan list route doesn't need admin token