only authenticating with token instead of username and token