get token
not only do not save password, also do not send it