fix auth; do not assume the token has no spaces