ability to set token per request
hydrate/dehydrate are now protected (@dawidpietrolaj)