add token to user