TBH. I don't know why exactly this is reinitialized, but when you look at Symfony Security code, you can notice [similar](https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Security/Core/Authentication/Provider/PreAuthenticatedAuthenticationProvider.php#L53-L75) [approach](https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Security/Core/Authentication/Provider/UserAuthenticationProvider.php#L57-L99).

Yet, there is no reason for renaming or `$token` to `$new_token` as old one is not used anymore.