Use helper Token.find_by_user_id_and_action to avoid SQL-error