added expiresAt to login response