don't leak token on failure