login works & saves token back to package.json