support token without user_id (for clients authenticating directly)
Merge branch 'pr1'