return only token on login