Protection around token association in case user isn't found