account creation, authorization, and token generation, getting there ... I think