fixed - now domain and auth_token are in Riskified object and loader is another file