allowing -_. in user id for auth token