Some applications can't access the token in the returned cookie, we should instead return the token in the response body. This will effect the web editor that expects the person logged in to be in the response body.