User is returned with token validation.