use token-based auth by default