adding token authentication