Eddie,
It appears to be a bug that when the username is not specified in the format MACHINENAME\username or DOMAINNAME\username, the token is successfully generated but is invalid. (submitted NIM071322)
Always specify the username in the above format when generating the token as a workaround for this issue.
Ravi