Hi - you may want to regenerate those tokens, don’t show those anywhere public. Good thing to do is to keep them in a config or properties file that’s not tracked by git.
You’d expect to see other users in the follow stream: https://dev.twitter.com/streaming/overview/request-parameters#follow :
For each user specified, the stream will contain:
Tweets created by the user.
Tweets which are retweeted by the user.
Replies to any Tweet created by the user.
Retweets of any Tweet created by the user.
Manual replies, created without pressing a reply button (e.g. “@twitterapi I agree”).
If you don’t want those extra tweets you can just filter them out by checking the tweet user