refactor "login" process before views, to not store the password locally & work with key, token only