fix login bug

If the user sends a token request he cannot get another api token