Remove user from verify token param list.

The token itself has the data of the user that created it, so we return the
user instance if the token is valid, raise same exceptions on error.