use token for auth, store identity in secure env