changed from cookie to token