ensure users have different tokens