adding token auth