globalAdminServer.getToken responds on GETs.
Cleaned up authentication strategy and jsdoc