add payload to auth and fix user token generators