[security] TokenFactory accepts urls as targetPath and afterPath.