fixed token on user show by making it dumb and not count characters. blasted at membership controller destroy