confusion with tokenAuth