Better create method like _get_token(user, password)