Saw what you mean. You pass through the tokenprovider to get the actual token from the code. That sounds reasonable. I assume that's where you also chain the caching but havent looked yet. 

I want to factor out the caching so that it can be reused between AD and SB WRAP as they are the same (just a different token type). 

I'll submit a follow up PR with that.