add token authentication for api session login