If cross scripting not allowed then just return json
implement timeout of token set to 16 hours.