User authentication with token WIP