token auth. bugfix