fixed login using authorization instead of token (requires token)