tokens should be passed on the logged in event

so they can be used by the disperate apis