createaccount api action didn't handle no token and no cookie