cleaned up main, moved token auth into its own package