Extracting authentication tokens