improved login: frontend gets access token, backend gets user data