[SECURITY] Fixed exploit in token types

Fixes an exploit due to missing check of token type used.

Fixes #1118 once merged.