def default_token_user_loader(self, token):
        """
        Default token user loader
        Accepts a token and decodes it checking signature and expiration. Then
        loads user by id from the token to see if account is not locked. If
        all is good, returns user record, otherwise throws an exception.

        :param token: str, token string
        :return: boiler.user.models.User
        """
        try:
            data = self.decode_token(token)
        except jwt.exceptions.DecodeError as e:
            raise x.JwtDecodeError(str(e))
        except jwt.ExpiredSignatureError as e:
            raise x.JwtExpired(str(e))

        user = self.get(data['user_id'])
        if not user:
            msg = 'No user with such id [{}]'
            raise x.JwtNoUser(msg.format(data['user_id']))

        if user.is_locked():
            msg = 'This account is locked'
            raise x.AccountLocked(msg, locked_until=user.locked_until)

        if self.require_confirmation and not user.email_confirmed:
            msg = 'Please confirm your email address [{}]'
            raise x.EmailNotConfirmed(
                msg.format(user.email_secure),
                email=user.email
            )

        # test token matches the one on file
        if not token == user._token:
            raise x.JwtTokenMismatch('The token does not match our records')

        # return on success
        return user