used the account property of the verifyPasswordToken result to save user in session