You must include a 'token' var in your request.