auth: save token to session/local storage