I wouldn't imagine the offline token inherently contains user-specific properties. Although I'd imagine when the offline token is generated through the authorization action that data could be stored away by the middleware app, right? I'd think that would be the place where the association is plain and can be written off.
