update tokenURL
add a custom authenticate method until i figure out a better way to do this