clean up string handling
handle empty tokens on auth
handle auth and the token better
a better nothing page