commented out token verification via login