AuthenticationToken cache_key should be based on token, rather than user

Token should be based on token, rahter than user, so that creation of a new token does not invalidate old token.