fix: When recover user data, use api token. On logout, redirect to /login page