split student/studentid objects, do not pass tokens over the air ever (security risk)