extract user_token into separate private method