Privacy idea allows policies where the TOTP token created can have a label that indicates (user@realm) in the Authenticator. Currently these values are not rendering so the label just says (@).  The fix requires setting these values on initialization of the token rather than later in a separate "assign".