node: use user._id for sub in createToken