add token to users.php