swapped around how the auth token gets passed.