login: password checkup works. Also token generation.