app_token clear text bug fixed