allow auth tokens