<button onclick="login()">Login</button>
<div id="contenitore"></div>

<br><br><br>

<input type="text" id="token">
<button onclick="list()">Lista Utenti</button>
<div id="contenitorelista"></div>

<script>
var login = function(){
    var xhttp = new XMLHttpRequest();
    xhttp.onreadystatechange = function() {
        if (this.readyState == 4 && this.status == 200) {
           // Typical action to be performed when the document is ready:
           document.getElementById("contenitore").innerHTML = xhttp.responseText;
               var par = JSON.parse(xhttp.responseText);
               if(par.status){
                   document.getElementById("token").value = par.token;
               }
        }
    };
    xhttp.open("GET", "/login", true);
    xhttp.send();
}

var list = function(){
    var xhttp = new XMLHttpRequest();
    //setto token nell'header
    xhttp.setRequestHeader("token", document.getElementById("token").value);
    xhttp.onreadystatechange = function() {
        if (this.readyState == 4 && this.status == 200) {
           // Typical action to be performed when the document is ready:
           document.getElementById("contenitorelista").innerHTML = xhttp.responseText;
        }
    };
    xhttp.open("GET", "/listautenti", true);
    xhttp.send();

}
</script>