finished token auth without user register