code vs token