change auth token logic