re-wrote login/logout and separated token_page() actions