client gets token now