admin added + token expiration and password validation