validate api token and login are starting to work but not really