better private token login method