also check auth token when using https