tokens now issued when clients authenticate