Restrict the token params to be only passed in the POST request body.