improved token handling and worked on auth