Token auth followup

Fixed a couple of suggestions.