fix npe
ignore invalid auth-tokens
add token-cache