Why `$success` is ever `true` ?
Missing use of `$casToken`.