[fix] when updating tokens, query is made on user_id, not username