Fake user token and fix NSS

[dmulder]

Fake the user token, but only if it's a valid user which we don't have the object id of yet. Also fix nss requests so the token doesn't get dropped.

Checklist

• [ ] This pr contains no AI generated code
• [ ] cargo fmt has been run
• [ ] cargo clippy has been run
• [ ] A functionality test has been added
• [ ] make test has been run and passes