chore: token only sign with user's _id and username