doing token, session and login