add handcrafted token auth