make sure auth is to be token based