tokens only allow one user to be created