expose /token entry point