Token authentication protection