fix up user token generation