implement simpler token based auth