User can be assigned a password token