hand-check token before expecting valid hex