add auth_token attribute to user