added token to request

- added token to request
- fixed password
- fixed create in model (not autoincrement id)