working toward cookie use
fetching token effectively