added token request controller and extended auth attribute to use it