authenticatable token and password policy