store access tokens
inject our javascript only on the log in page