Allow sandboxes to be used with token logins

This appears to be an oversight. Just passing sandbox into the token
login method.