token based authorization
use yaml as config