windows uses TLS for strtok, strtok_r is a safe bet elsewhere