throw exception to js land; use unique_ptr to auto free pToken.

Signed-off-by: abbr <wenfred@gmail.com>