no longer putting token in params, using token from authentication