New strategy: token authenticatable.