tokens should be treated like passwords