master added token route and authentication