We were asking for too many parameters for changing the plan, token is not always necessary.

endpoints/api.py

@@ -1126,7 +1126,7 @@ def subscription_view(stripe_subscription, used_repos):
 
 @app.route('/api/user/plan', methods=['PUT'])
 @api_login_required
-@required_json_args('token', 'plan')
+@required_json_args('plan')
 def subscribe_api():
   request_data = request.get_json()
   plan = request_data['plan']

test/test_api_security.py

@@ -74,7 +74,7 @@ class TestNoAccess(ApiTestCase):
   auth_username = NO_ACCESS_USER
 
 
-class TestNoAccess(ApiTestCase):
+class TestReadAccess(ApiTestCase):
   __metaclass__ = SpecTestBuilder
   spec_func = build_read_access_spec
   auth_username = READ_ACCESS_USER