change to token-based authentication