Did not mean for you to infer that the UserID was stored in clear text cuz it ain't but the human readable form of it is what is tokenized, not the SID of the account.
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.