User creation, async, validation tokens figured out