change user to decoded_token