do token auth

This allows me to use the secure port directly rather than needing a stood up nginx