PLD: add token authentication, order matters, closes #614