I suggest updating the login form's "query" to:

  SELECT token, user_id FROM users
  WHERE username = '____'
  AND password = HASH('____')
  -- Or maybe: AND password_verify(password, '____')
  LIMIT 1;

I assume you are already hashing passwords, but the current login form's 'UI query' is enough to raise questions