don't throw on too many tokens

instead, take as many as are allowed and continue

Auditors: blackmad