now preserving rights given by a token, so we can use them in requests