Token auth fixes