fix login API - set access token