The API has no way of knowing who moves a token, there is no id attached to the event, just the change to the token itself. I would suggest sending a prompt to each player that controls the token and ask them if they want to follow it. That would let them move with the token if they were the one that moved it, but wouldn't force anyone to move. If you post the code, we could try to find a way to fix your user id concatenation problem. It sounds like you need to do a .join(',') somewhere that you have a .join('').