I have to admit that I don't know if having user in the security context will be useful or not.
I put just in case, as a first implementation, but maybe we will not use it.

And the goal for this step is to create the token in the security context for the connected user, as it's not done automatically as the context from the application is not shared with the one we manipulate in the test.
Maybe it's not meant to be an actual step but just a protected function used in a step.