more fixes related to auth.Token vs. auth.Token()