User token length restriction fixed