return a value for auth token, not pointer