enable token authentication