/stats now requires login
typo in tokens.html