reflected login, token api changes