put the restricted token where it belongs