needs a token to update user