token authentication with play framework