question about "auth token" policy and adaptation of hlrsync.py