make the login controller comply to RFC 6749
better name for the route setting
expect the response as defined in RFC 6749
send the token as "Bearer" token