best handling of login/token