add code to delete token on client if log in failed