Properly handle TokenAuth at all endpoints