Also makes sure to properly unset other tokens when a new one is set as default. Finally, we make sure that a user is always set in our payment token tests (which was broken in some WP versions which alerted us to some broken tests).
* Fix up some comments to match other comments in the WC code base
* Add some missing esc_* functions
* Add a gateway filter to get_customer_tokens + a test for it