turned out that i was doing everything right except the code in the sendLoginResponse(Request $request). I don't know much about this code but this code was supposed to set remember cookie expiration time to 1 year. may be it does that. but it was definitely causing issues. on commenting out these lines, the whole login response works just fine.
for new comers like me. that i am. I explain how whole remember cookie works.
when user logs in with remember me enabled then then user's login credentials passes through Auth::attemp($this->credentials(), $remember), here $remember variable is a flag that tells whether user want to be remembered or not. if $remember variable is set then the server sends a remember cookie along with laravel_session cookie and xsrf cookie. if you have delete cookie enabled in your browser( like in my firefox ) then you will see expiration time of cookie as session. but when you have delete cookie enabled disable, then you will see expiration time of remember cookie as 5 years. so the whole point is to save this cookie in browser and if the user closes the browser and the browser doesn't delete this cookie. then if the user visits that your site again then with request, this cookie also goes to the server. the server authenticates this cookie so the server automatically login the user. the cookie remains validated till the user doesn't logged out.