more cleanups in Token/State/AccessToken/RefreshToken