hiding auth token