you should always have a token or some other form of authn as well