reference the Internet-Draft specifying token auth