Hiding user.confirmation_token from api calls