Consider auth tokens from the webclient and passforward passwords