exclude "tokens" user param from token validation response