use token to authenticate players