add token based authentication