manual login and token auth curl no html