apptoken authentication and now works with hidden columns