implement authtokens for thiry-party clients, untested