new user, token validated