supported Token authentication, w/wo cookies