use of $token instead of saving the password in the session; fixed typo ...

...for bad_instance


see https://github.com/ztec/ZtecSecurityActiveDirectoryBundle/issues/6