logging in now saves the token and secret to the user object