token authentication fixes