move auth_token into data for api/users/login