require 'bcrypt' for user_token