now using authtoken instead of database dependent ID