symfony/symfony — comment on commit 9d2ab9ca9c1762c529e053cefd39a5e626102133
File: src/Symfony/Bridge/Doctrine/Security/User/EntityUserProvider.php line 83
By beberlei:

How about additionally saving the username into the token and making an assertion on username == user->getUsername()?