mostly completed token authentication and logging off the back of that