adding token authentication to the api