we should eventually put these sid and token stuff in a global `config` file. safer that way.