Much like log4j, et al, our logger understands error objects and handles them specially, it's actually best to put the err first, as in

```
log.warn(err, 'Unable to verify token.');
```