fix user token validation