We need to wait to create the token until we decide on whether we're impersonating a different user, otherwise we'll create the token for the original user and the impersonated user won't be able to authenticate.