begin building code which will protect resources with an auth_token header