Use PMS Tokens on loopback URL + cleanup of Token