Is it possible to manipulate user metadata without using a Management API token?