First off. Thanks for writing the module! Much appreciated.
I'm going to issue a PR to remove the call of toLowerCase() on these lines. This actually bit me and I spent quite a bit of time trying to figure out what went wrong. I don't think it should be the responsibility of passport-token to make the strings lowercase. I think that concern should be left up to the person implementing.