change auth.user/pass to token