only save tokens for signed in users