now login form contains token info