token authentication working, removed token_controller