we need to be able to look up users by their token; so the token has to be unique