post user - return token md5