only visible with valid authenticationToken