You're logging the user in without validating the token. This is a security problem. I can login as any user I want.