Use token values instead of value, as api.user may not always
return result for loginid. Fixes #921