It depends. The 1st time we create the Device record, we need to set the deviceToken. I'm not sure if we have to be so restrictive here. It won't be so harmful if the client app decides the change the deviceToken with a faked one :-).