first pass at static auth token