[389-devel] Please review: token auth design