more preVerifyToken docs, strictSSL