fix token fixation in login
fix commas in an array.