added: login
added: token invalidation on logout