removed FileToken and CollectionToken, replaced by POST authentication