token handling on server.py