[update] return access token during login