invalidating and refreshing subusers + get token added