send token in json not cookies