So I don't know how consequential it is for this, but it seems like this is easy to fake the way the code is written now. For instance, if I want to get the token for user "dave", can't I just make a user "aaaaaaaaaaaaaaaadave" and use the second half of it?