hid the tokens, updated authentication