changed token replacement to use stringbuilder