Factor out token -> user implementation into single call