set tokens in req.user