Remove "_token" from parseIdentity

also add a note (or say warning) about login throttle in the UsersController