using token.userId instead of email