bad token snuck in