token authentication returns a token