use token auth in tests, prefer it when curl'ing