User can delete their package

does anyone else ever see this token? i.e. is the same token used in the URL when the people receive the package?