added token secured path and tokenOnly option