Don't actually trust the username on the callback; check the token.