Don't ship tokens to client in source code.