remove token and secret from user model