Further build-out of server/client for token auth