use token to auth