does this need a bad-token error path?