Add token-based auth