bug fix in get user by token