users mess with their own data and half token implementation