moved MAX_AUTO_AUTH_USERS to ENV_TOKENS