get rid of web_tokens, be strict about opts