login: reply with token.