listen on all ip by default
use env to provide token