Token delete has to go through the auth env