strip auth token