token doesn't appear in authentication request