http token auth working