token auth accepting only post verb