check for token before returning user