use token instead of user/pass