Updated strategy to also look for username and token as a query string parameter. Mostly useful for testing.

Also fixed the options check, to not crash on toLowerCase when you don't supply options