FIX: token should be read only by owner