Okay, this is confusing to me. What exactly is in the `denied` key? Since below you return if it's set, the only time this fallback matters is if there's a token in `denied` and you want to return a tokenmismatch error instead of the authdenied error. Is that the intent?