rebased token auth changes

this is @dsparacio #160 rebased and with one fix for index.html