If a token is only allowed to be 0-9a-f this should be updated to reflect that and mb_strlen would no longer be applicable but strlen would be.