The user token is based on the username, password and email address. If any of them change, the token is recalculated.
Have updated the profile call to return the extra fields: username, email and avatar_img
It does now!
I can't help with your first query but unless I've misunderstood the question a look at the swagger docs (https://rebrickable.com/api/v3/docs) might answer the second.
There are two calls listed:
The first of these seems to search based only on the set name while the second allow you to search for a set number. If you are using the second it is an exact match only which is returned (ie you need to add -1 to the end of most official lego set numbers). If you use the first and put a set number in you will sometimes get a result but it will rarely be what you are looking for (eg https://rebrickable.com/api/v3/lego/sets/?search=60050 will return the set 66493-1 because it is "City Super Pack 4 in 1 (60050, 60052, 7499, 7895)",