use of $token instead of saving the password in the session; fixed typo for bad_instance