modified login function can send back token