more robust AuthToken