begin letting go of token auth, fix direct sign-in failure bug