changing some things up to allow for csrf-less auth

fixed a bug in /tokens/ endpoint that caused 500's.