#master: security token explained