if the token_loader doesn't return a user, there's no ID