create user and validate existing and generating token, bad code