authToken: do not use req in token get