separate pw/token auth, ditch custom http codes