one unique applyToken method common for auth and authz