move to server only, enhance the login system

now we have a token system
the client part is fully broken
every request are POST