token route should only have store