so if you don't have permission, we delete the token? that seems bad. couldn't I just bruteforce the API, trying a bunch of UUIDs and all those reply tokens would then be unusable?