why `$token &&` is needed? AFAIK, the check is already done in `isAnonymous`.