proxy: actually pass the token rather than a token-length string full of zeroes