That shouldn't raise a 500 though. It's just an invalid token, so we give an error message on false.