move /login to /users/self
return 401 for bad tokens