add PostToken model, customize TokenAuthentication