Only token authentication are allowed