Why create a user when an invalid token is supplied? Only create a user when the token was empty, null or whitespace.