make token and username private to not pass sensible data around