get rid of hard coded auth token