fix token init bug and auth bug