This method should really fail ugly if token is None and username is different than service account.