hopefully fixed evil confusion that I created between api_token and auth_token