move mongo related stuff to config
remove access token from userlogin