associate an api token with each user.