Check token's user prior to (re)loading user from user provider