authtoken belongs in api-paste