use HTTP_AUTHENTICATION Token for access scoping