Moved token auth to route config