Security: don't print/return user token

[StefanKarpinski]

When I do PkgAuthentication.authenticate() it prints all my sensitive token data to screen, which isn't great. Anyone who can photograph my screen (which might be projected or recorded) can now impersonate me. So we should probably avoid printing or even returning this data.