Almost done. TO FIX:
- why token does not work
- token has to be created new everytime?
- csrf
- sessions (should not be used)