don't log tokenExpected in production? (i know our logs are for our eyes only, maybe i'm just being superstitious)