security : add controls on token manager