add User model class; beginning of server side token verification