improve `MongoTokenUser` in token-login demo