login with unverified token