#589 generate token minor changes

Resolves #589 
- return `token` attribute in addition to `_`.
- allow user without password.