require token for login