authenticate user on api call
use 64 length token