What you have described is exactly how a wallet drainer works! Asking new users to craft a special transaction on an unnamed website is extremely dubious and unless they understand exactly what they are signing they can authorize a transaction to send you ALL THEIR FUNDS! I suggest you come up with another method of sending users free tokens. It is extremely irresponsible to ask new users to do this. Even if it works initially there is no guarantee you are not waiting for a loaded wallet to craft the drain transaction. Only experienced users should be signing transactions on websites that they trust and even then they need to review every transaction they sign.