You need to provide a user token in the URL