set default authentication classes to token and session