77295342 token request send cart

I'm fine with it, though I would probably move it somewhere (e.g. `scripts/test_token_auth`) to make it clear that it's not run automatically.