authToken now has exactly one tokenId, for all three APIs