Simpler token auth