added token auth, moved around