Token handling a little better

Set your HQ token in app.js for now, I will handle login stuff asap.