handle visits with a login token