changed order of token auth to first