redirect with token cookies