Do we need/want to give the details of why the token is invalid? I didn't find a reference in the spec, and would prefer to just say "invalid token", with no further details.