fix endpoint that merges accounts

the /auth/merge endpoint was broken due to the renaming of the keys
that are returned from parseAccessToken. It was overwriting the
correct names with undefined variables.