More work on token based authentication. Almost done.