simplify token auth