use requireServerToken when needed, update tests