invalidate token on login