robust authentication script with token info