Pass user to store_token, not username

This means the argument is always present, which username might not be if it's never been set.