user confirmation token readonly now