changed system to use token instead of cookie