Change user lookup to migitate timing attaks
Update helpers for token auth