leaking a token