change auth system to token-based, refactor php code