tokens now indicate user
encrypting token response