log tokens; fix auth