code: public UserAuthentication getOrCreateUser(App app, String accessToken) {
  		UserAuthentication userAuth = null;
  		User user = new User();
  		if (accessToken != null && accessToken.contains(Config.SEPARATOR)) {
  			String[] parts = accessToken.split(Config.SEPARATOR, 3);
  			String email = parts[0];
  			String name = parts[1];
  			String pass = (parts.length > 2) ? parts[2] : "";
  
  			String appid = (app == null) ? null : app.getAppIdentifier();
  			User u = new User();
  			u.setAppid(appid);
  			u.setIdentifier(email);
  			u.setPassword(pass);
  			u.setEmail(email);
  			// NOTE TO SELF:
  			// do not overwrite 'u' here - overwrites the password hash!
  			user = User.readUserForIdentifier(u);
  			if (user == null) {
  				user = new User();
  				user.setActive(Config.getConfigBoolean("security.allow_unverified_emails", false));
  				user.setAppid(appid);
  				user.setName(name);
  				user.setIdentifier(email);
  				user.setEmail(email);
  				user.setPassword(pass);
  				if (user.create() != null) {
  					// allow temporary first-time login without verifying email address
  					userAuth = new UserAuthentication(new AuthenticatedUserDetails(user));
  				}
  			} else if (User.passwordMatches(u)) {
  				userAuth = new UserAuthentication(new AuthenticatedUserDetails(user));
  			}
  		}
  		return SecurityUtils.checkIfActive(userAuth, user, false);
  	}
docs: Authenticates or creates a {@link User} using an email and password.
  Access token must be in the format: "email:full_name:password" or "email::password_hash"
  @param app the app where the user will be created, use null for root app
  @param accessToken token in the format "email:full_name:password" or "email::password_hash"
  @return {@link UserAuthentication} object or null if something went wrong