Prevent client from updating user auth_token