fix token auth