Pluggable token base authentication