adding a token auth strategy