login/signup returns token and username