support token authentication