add login validator, put token, and login role inside session