Should probably change this comment - it looks like your change below means xoBareToken now becomes just the user part.