Move token check.

The check for a valid token only needs to happen if the username we're
modifying exists meaning we're not creating a new user.