prevents exploiting implicit mysql typecasting

This should prevent an attacker from issuing a request where he sends a token param casted to integer. MySql would cast the value attribute of Token to integer which is either the integer at the beginning of the value or, in absence of such, 0.