add token invalidation on login