Authentication method with impersonal token cards