A more precise handling of user-token match errors

Signed-off-by: Pierre-Alain Dupont <pad@melix.net>