sweet, sending the token works. let's remove the need for passwords.