add auth_token to user