added token authentication; still have to fix case where if /locations is called without being authenticated, server throws