Note on configuring TokenAuthentication