changed authentication strategy to accept only a token