only show users with a token