We have both: OC_Util (blank page) and OCP\JSON (JSON error message), since this should *never* happen I really don't care if an attacked user gets an "Token expired - please reload the page" instead of a nice error page ;-)