#3 and #4: add token auth & fix read method not working