don't log getSessionId input (username/password)
added demo.log stream handler
moved token code to credentials() in base class