Avoid redundant user lookup but refactoring update_auth_token api.

Both calls to update_auth_token had argument '$user["id"]' and the
first thing update_auth_token does is looks up the user record.
Change update_auth_token api to take the user record instead.