Fixed to use user_id in token handling