token consumerId is now the username