only raise TokenInvalid on 404
bump version