Perhaps move this section up to just before 'When to verify tokens'.  Otherwise someone might work their way through the instructions only to find that they have been doing the wrong things.