using uuids for tokens, and creating session after user create (not sure if thats a good idea yet)