move to auth_token instead of basic auth