standardise "box" (rather than "boxName") in user-facing stuff
pass tools a "publishToken" not a "token", and also pass the box name - fixes issue #39