use "uid" instead for token auth handling