change how identity tokens are looked up server-side tor educe some of the annoyance