don't generate a token on user creation, use User#toke method to generate a token