rollback to auth_token