require only token for BBSAUTH