you can (and should :)) use it (token auth) with ssl. To get SSL is not a problem today, and will cost you nothing if you use letsencrypt.org