added token auth and fixed bugs of not using local vars