tokens need to be URL-escaped
missing the field name
probably no harm letting admins modify this field as well