token based authen, activity logs