Make token revoke user sensitive.