remove login token harvesting