minor bug fix to token authentication.