safer "token" name. add mutex.