curl for user and user_token