changed cookie to token