@chrislaughlin are we using token or session for authentication. Where is the server code for auth?