fixed token response in the webapi to follow the spec