token changes to bypass auth