finished with all login and token validation. I think...