update login to return token