send app_token only when sign_in