refactor login to use AuthToken factory, move Api Url to constant in app.js