detect when requesting a token for another user and explain to the user what's happening, fixes #3