It sounds like the issue is related to the shared hosting environment. It's possible that the hosting provider has some sort of security feature that is stripping out the token key from the response. You could try contacting the hosting provider to see if they can provide any insight into the issue.
If that doesn't work, you could try changing the key name from token to something else, such as access_token. If the issue is related to the underscores, then this should fix the problem.
return Response([
'access_token' => $token,
'status' => 'success',
'message' => 'loggedIn',
'user' => new MeResource($user),
], 200)->withCookie($cookie);