Как сделать авторизация через token php?

UPDATE users SET token = '' WHERE token = :token;
UPDATE users SET token = :token, device = :device WHERE phone = :phone

if($act == 'auth'){
	$phone = isset($_POST['phone']) ? ($_POST['phone']) : '';
	$password = isset($_POST['password']) ? ($_POST['password']) : '';
	$token = isset($_POST['token']) ? ($_POST['token']) : '';
	$device = isset($_POST['device']) ? ($_POST['device']) : '';
			if($device == 'android'){
				$device = 0;  
			} 
			else if($device == 'ios'){
				$device = 1;
			}
			else {
				$device = 0;
			}
			echo $device;
			if ($phone == '') {
					$errors[] = 'Введите номер';
			}
			if( !$set->validatePhone($phone) ){
						$errors[] = 'Не верный формат номер телефон';
			}
			if ($password == '') {
						$errors[] = 'Введите пароль';
			}
			if (empty($errors)) {
				$success = $set->auth($phone,$password);
					if($success) {
						$set->change_token($phone,$token,$device);
					}
			}
	echo $set->result($object, $success, $errors); 
}

public function auth($phone,$password){
        if($phone == '' || $password ==''){
            return false;
        }
        $client = new DB();
        if($phone){
            $q = $client->pdo->prepare("SELECT id,count(*) FROM users WHERE phone = :phone");
            $res = $q->execute(array('phone' => $phone)); 
        }
        if($password){
            $q = $client->pdo->prepare("SELECT id,count(*) FROM users WHERE password = :password");
            $res = $q->execute(array('password' => self::hashit($password))); 
        }
        $res = $q->fetchAll();
        print_r($res);
        if($res['count(*)'] == 1){
            $_SESSION['id'] = $res['id'];
            return true;
        }
        else{
            return false;
        }
    }
    public function change_token($phone = '', $token = '', $device = '') {
        $client = new DB();
        $q = $client->pdo->prepare("UPDATE users SET token = '' WHERE token = :token");
        $res = $q->execute(array('token' => $token));
        $q = $client->pdo->prepare("UPDATE users SET token = :token, device = :device WHERE phone = :phone");
        $res = $q->execute(array(
                                    'token' => $token,
                                    'device' => $device,
                                    'login' => $phone
                                ));
        if ($res) {
            return true;
        }
        else{
            return false;
        }
    }
    public function checktoken($token, $phone) {
        $salt = '123';
        if(md5($salt.$phone.$salt) == $token) return true;
        else return false;
    }