wip authentication
work on secret token authentication