update example so that tokens arent stored in cookies