Do you create user if it doesn't exists? and only return null when the token is invalid?