finished auth with token storage (dirty for now)