reorganise for clarity around the Token object
split out response and request