this one works great
return response()->json(['message' => 'Logged in successfully']) ->cookie('access_token', $token, $expiration, '/', null, true, true, false);
whats the most secure way to pass tokens?