fixed auth token passing, added zxp extension signing