tokens: Make sure vps signups check the user token (keep in mind this doesn't include new-user signups, we don't have any way to identify their token as theirs... exploiters may as well just create the users themselves if they wanted to make users through someone.)