remove identity password from cookies, replace it with a token