final touches to authentication API; token web methods complete