Add the AuthToken model
Use the AuthToken to restrict POST to private dir